Base64 Encode and Decode Text
Convert text to Base64 and back without wondering which alphabet, padding convention, or validation rule a tool silently chose.
Run — free
This deterministic converter handles Unicode as UTF-8, supports both standard RFC 4648 Base64 and its URL-safe variant, and rejects malformed decode input instead of returning corrupted text. Use it interactively in the browser or call the API when an application needs repeatable conversion. Each successful response contains one result string, making the output straightforward to copy, store, compare, or pass to the next step in a pipeline.
Encode UTF-8 text into a portable Base64 representation
Choose encode mode when you have ordinary text and need an ASCII representation suitable for a text-only field, configuration value, JSON document, or integration boundary. The converter first represents the supplied string as UTF-8 bytes, so accented letters, emoji, non-Latin scripts, line breaks, and punctuation are processed consistently rather than being truncated to an older single-byte character set. It then groups those bytes according to RFC 4648 and returns the Base64 result. With the standard variant, the output uses letters, digits, plus, and slash, with canonical equals-sign padding when the final byte group is incomplete. With the URL-safe flag enabled, plus and slash become hyphen and underscore, and generated padding is omitted to produce a compact value suitable for route segments or query parameters. Base64 is an encoding rather than encryption: anyone with the value can reverse it, so confidential material still needs appropriate transport and storage protection. The returned object contains only the result string, which keeps scripted processing simple and deterministic.
Decode strictly instead of accepting corrupted input
Choose decode mode when the supplied text is already Base64 and you want its original UTF-8 text. The selected variant matters during validation. Standard mode accepts the standard plus and slash symbols, while URL-safe mode accepts hyphen and underscore; characters from the other alphabet are treated as invalid rather than silently rewritten. The decoder also checks that padding appears only at the end, that no more than two padding characters are present, that explicit padding matches the encoded length, and that the length can describe complete bytes. It verifies unused trailing bits too, which prevents multiple noncanonical strings from being treated as the same byte sequence. Whitespace is rejected because the input contract calls for a Base64 string, not MIME-formatted lines with formatting characters. Finally, decoded bytes must form valid UTF-8. A binary file may be perfectly valid Base64 yet still be unsuitable for this text-focused capability; in that case, decoding returns an input error rather than replacement characters. These checks make failures visible at the integration boundary, where they are much easier to diagnose than damaged content discovered later.
Select standard or URL-safe Base64 for the receiving system
The correct variant is determined by the system that will consume the value. Standard Base64 is common in encoded document fields, data interchange, and specifications that explicitly show plus, slash, and equals signs. URL-safe Base64 is designed for contexts where plus and slash have special meaning, including URLs, filenames, cookies, and token components. Setting url_safe changes both encoding and decoding, so it should reflect the alphabet actually expected by the other side rather than being used as a cleanup switch. When decoding URL-safe values, either canonical padding or omitted padding is accepted when the length permits it; when encoding, padding is deliberately omitted for the compact form widely used in URL contexts. For dependable pipelines, store the variant alongside the data or define it in the surrounding protocol instead of guessing from a sample that may contain only letters and digits. The browser tool is useful for one-off inspection, while the API costs $0.002 per request for automated workflows. Both paths use the same pure conversion logic, produce the same result, make no network call from the algorithm, and do not rely on random values or the current time.
What you can do with it
Prepare text for a JSON integration
Encode Unicode text into an ASCII Base64 field required by an external schema.
Inspect an encoded configuration value
Decode a Base64 value with strict validation so malformed input fails clearly.
Create URL-safe token components
Convert UTF-8 text with the hyphen and underscore alphabet and unpadded output.
FAQ
What does a request cost?
The API price is $0.002 per request, and the browser version can be used interactively for free.
Is Base64 encryption?
No. Base64 only represents bytes as printable characters and provides no confidentiality or authentication.
How is Unicode handled?
Text is encoded to UTF-8 bytes before Base64 conversion, and decoded bytes must be valid UTF-8.
What changes when URL-safe mode is enabled?
Encoding uses hyphen and underscore instead of plus and slash and omits padding; decoding validates that same alphabet.
What decode input is rejected?
Invalid alphabet characters, whitespace, impossible lengths, misplaced or incorrect padding, nonzero trailing bits, and decoded bytes that are not valid UTF-8 all cause an input error.
For developers — API access
Everything on this page is available programmatically. This section is for teams who want to wire it into their own systems; everyone else can just use the tool above.
API endpoint
Prefer to automate it? One authenticated POST creates the task; the result comes back by webhook or a signed link. The same capability also runs here on the web, by email and from Telegram — and soon from our app too.
Call it from your stack
curl -X POST https://api.kit.forhosting.com/data/mime-base64-encode-decode \
-H "Authorization: Bearer $KIT_KEY" \
-H "Content-Type: application/json" \
-d '{"text":"Hello, world!","mode":"encode"}'const res = await fetch("https://api.kit.forhosting.com/data/mime-base64-encode-decode", {
method: "POST",
headers: {
"Authorization": `Bearer ${process.env.KIT_KEY}`,
"Content-Type": "application/json"
},
body: JSON.stringify({
"text": "Hello, world!",
"mode": "encode"
})
});
const { task_id } = await res.json();import os, requests
res = requests.post(
"https://api.kit.forhosting.com/data/mime-base64-encode-decode",
headers={"Authorization": f"Bearer {os.environ['KIT_KEY']}"},
json={
"text": "Hello, world!",
"mode": "encode"
},
)
task_id = res.json()["task_id"]<?php
$res = file_get_contents("https://api.kit.forhosting.com/data/mime-base64-encode-decode", false, stream_context_create([
"http" => [
"method" => "POST",
"header" => "Authorization: Bearer " . getenv("KIT_KEY") . "\r\nContent-Type: application/json",
"content" => '{"text":"Hello, world!","mode":"encode"}',
],
]));
$task = json_decode($res, true);body := bytes.NewBufferString(`{"text":"Hello, world!","mode":"encode"}`)
req, _ := http.NewRequest("POST", "https://api.kit.forhosting.com/data/mime-base64-encode-decode", body)
req.Header.Set("Authorization", "Bearer "+os.Getenv("KIT_KEY"))
req.Header.Set("Content-Type", "application/json")
res, _ := http.DefaultClient.Do(req)Example request
{
"text": "Hello, world!",
"mode": "encode"
}Example response
{
"task_id": "tsk_a1b2c3d4e5f6a1b2c3d4e5f6",
"type": "data.mime_base64_encode_decode",
"status": "queued",
"_links": {
"result": "/tasks/tsk_…/result"
}
}The API is asynchronous: the call returns a task_id immediately and the result arrives by webhook. Polling is capped at 1 req/s per task.
Pricing
Published price — no tokens, no invented credits. A failed task is never charged.
Limits
max_mb | 25 |
Errors
| HTTP | Code | Meaning |
|---|---|---|
401 | unauthorized | Missing or invalid API key. |
402 | insufficient_balance | Your balance doesn't cover the task price. |
404 | unknown_type | That task type doesn't exist. |
429 | rate_limited | Too many requests. Use the webhook instead of polling. |